ja4-platform

Files

Jacquin Antoine 8d817414b3 fix(ebpf): rename Apache BPF maps to avoid conflicts with nginx

- Rename apache_pid_map to apache_http_pid_map
- Rename apache_read_args_map to apache_http_recv_args_map
- Update all references in C code and Go loader
- Attempt both tracepoints and kretprobe for Apache HTTP capture

Test results:
- Rocky 9 (kernel 5.14): nginx HTTP capture works perfectly
- Rocky 10 (kernel 6.12): Apache HTTP capture not working (headers=0)
- CentOS 8 (kernel 4.18): Apache HTTP capture not working

The issue appears to be that Apache event MPM may not use recvfrom()
in the same way as nginx, or uses a different code path.

Further investigation needed for Apache HTTP capture.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-04-20 16:05:54 +02:00

bpf

fix(ebpf): rename Apache BPF maps to avoid conflicts with nginx

2026-04-20 16:05:54 +02:00

cmd/ja4ebpf

feat(ebpf): add Apache httpd HTTP capture via kretprobe recvfrom

2026-04-20 14:11:56 +02:00

docs

fix(ebpf): replace tracepoint with kretprobe for sys_exit_recvfrom

2026-04-20 13:29:01 +02:00

internal

fix(ebpf): rename Apache BPF maps to avoid conflicts with nginx